Per-File Encryption vs. Disk Encryption vs. DLP: Which One Actually Protects CUI When It Leaves Your Environment?

Most defense contractors handling Controlled Unclassified Information have some form of encryption in place. The problem surfaces during a C3PAO assessment when the assessor asks a specific question: "How do you know the CUI on this device — or that device, or the one your subcontractor took home — is actually protected right now?"

Disk encryption passes that question for managed, powered-off devices. DLP passes it for files that haven't left yet. Neither of them passes it for a file that's already on a personal laptop, already in a personal OneDrive folder, or already attached to an email from six months ago.

The distinction matters because CMMC Level 2 assessors are trained to find the gap between what your System Security Plan says and what your environment actually does. The most common gap in the file security layer isn't about which encryption tool you chose; it's about which scenarios your chosen approach was never designed to handle.

Here's what each method actually covers.

Disk Encryption: Strong Foundation, Fixed Boundary

Disk encryption — BitLocker, FileVault, or equivalent — encrypts the entire storage volume on a device. When the device is powered off or locked, the data is inaccessible without the decryption key. For endpoint security, it's a foundational control.

What it protects: A device that is powered off, stolen, lost, or returned at end-of-contract. If an employee's laptop is left at an airport and a threat actor picks it up, disk encryption is what keeps them out.

What it doesn't protect: A device that's powered on and in use. Once the disk is unlocked — which is every moment the device is running — files are accessible in plaintext to anyone operating with valid credentials. The encryption is active at the storage layer, not at the file layer. The moment a user opens a CUI document, it's decrypted in memory and accessible. The moment someone with valid credentials (or stolen credentials, or a credential stuffed into a VPN session) accesses those files, disk encryption offers no protection.

The CMMC assessment problem: SC.3.177 requires FIPS-validated cryptographic protection of CUI. Disk encryption using FIPS 140-3 validated modules satisfies this at the device level. But it doesn't satisfy the control for CUI that has moved off that device — to a shared drive, to a subcontractor's system, to a USB drive, or to a cloud storage service. The assessor will ask about all of those locations.

DLP: Boundary Control, Not Data Protection

Data Loss Prevention tools monitor and control the movement of sensitive data. When a user tries to email a file containing CUI, DLP can block it. When someone tries to upload it to an unauthorized cloud service, DLP can intervene. It's a governance and detection layer.

What it protects: Data attempting to leave through monitored channels. DLP is useful for catching accidental data exposure before it happens — a contractor attaching the wrong file to an email, a user uploading to a personal Dropbox, or a print job to an unauthorized printer.

What it doesn't protect: Data that's already left. DLP has no reach over a file that was transferred before the policy was in place, moved via an unmonitored channel, or copied to removable media before the controls were deployed. DLP tools generate false positive rates exceeding 73%, which in practice means alert fatigue, policy exceptions, and gaps that widen over time. More critically: DLP doesn't encrypt. If a file bypasses DLP, it lands in plaintext wherever it ends up.

The CMMC assessment problem: DLP is a supporting control — it contributes to the overall CUI protection posture, but it doesn't satisfy SC.3.177 (encryption) or SC.3.187 (key management) on its own. An assessor evaluating your encryption controls won't accept "we have DLP" as evidence that CUI is cryptographically protected in all the places it exists.

Per-File Encryption: Protection That Travels With the Data

Per-file encryption applies a unique cryptographic key to each individual document at the point of creation or classification. The encryption lives in the file itself, not in the storage system around it, not in the network boundary through which it passes.

What it protects: The document, regardless of where it is. A per-file encrypted CUI document is protected on a managed laptop, on a personal device, on a USB drive, in a personal cloud storage account, and in an email attachment sent to the wrong recipient. If a file is exfiltrated, an unauthorized process gets nothing — because unless contextual access controls are met, access is denied entirely. The unauthorized party isn't handed back noise; they're denied entry.

Access control at the file layer: With FIPS 140-3 validated per-file encryption and context-aware access controls, who can open a file — and under what conditions — is governed by identity, device trust level, location, time, and role. A file opened on a managed, enrolled device inside your network behaves differently from the same file accessed from an unmanaged device on a home network. The policy travels with the file.

In-use encryption: Data is decrypted in real-time only, never written as plaintext to disk.  This closes the gap disk encryption leaves open, ensuring compliance with NIST 800-171 requirements for CUI on non-organizational systems (contractor laptops). Even while a file is actively in use, plaintext never touches storage.

The ransomware scenario worth noting: When ransomware encrypts files at the local storage layer, it's targeting file contents. With per-file encryption in place, ransomware encrypting the local copy gets nothing, because unless contextual access controls are met, access is denied entirely. The attack surface for the encrypted file is effectively zero.

The Comparison: What Each Approach Covers

CMMC Level 2 Control Mapping

The pattern is consistent: disk encryption satisfies device-layer requirements when the device is controlled and known. Per-file encryption satisfies data-layer requirements regardless of device, location, or environment. For CMMC Level 2 assessors specifically looking at where CUI goes beyond your managed device fleet, only one of these approaches has a credible answer.

The Practical Decision

For defense contractors working toward CMMC Level 2, this isn't a choice between approaches; it's a sequencing question.

Disk encryption is table stakes. BitLocker or equivalent on managed endpoints is assumed as a baseline control. DLP is useful for visibility and governance, particularly for catching accidental exposure before it happens.

But neither of those approaches answers the question a C3PAO assessor asks during an evidence review: "Show me that every CUI file in your environment — including the ones on contractor devices, the ones shared with subcontractors, and the ones that have moved outside your managed infrastructure — is cryptographically protected right now."

That answer requires per-file encryption. Not instead of what you already have, on top of it.

One More Thing Worth Noting

The November 2026 CMMC Phase 2 deadline affects approximately 80,000 defense contractors who handle CUI. The DoD estimates the three-year compliance cost for small contractors at roughly $487,970. A significant portion of that cost comes from remediation — organizations that assumed their existing disk encryption or DLP investment covered the file security domain, and discovered during a gap assessment that it didn't.

The contractors getting ahead of that remediation cost are the ones distinguishing clearly between what each layer covers now, before the assessor does it for them.

FAQs: Per-File Encryption vs. Disk Encryption vs. DLP